verifiedISO/IEC 27001:2022
ISO 27001 Annex A 5.13Labelling of Information
Official control statement
An appropriate set of procedures for information labelling shall be developed and implemented in accordance with the information classification scheme adopted by the organization.
verifiedISO/IEC 27001:2022Annex A 5.13
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Create and use clear labels to show how sensitive information is, so it is correctly handled.
Organisational controlsISO/IEC 27001:2022
record_voice_over
What this means in practice
This control is about putting labels on information to show how sensitive it is. This matters because the labels help people know how to handle the information properly. Without clear labels, sensitive information could be mishandled or exposed, leading to data breaches or privacy violations.
01 - Overview
Framework
ISO/IEC 27001:2022
Control effect (Control Stack)
Preventative
ISO 27001 domain
Organisational controls
Classifications
N/A
Official last update
24 Oct 2022
Control Stack last updated
29 Sept 2026
priority_high
Why it matters
Without classification-based labels, staff and systems may apply the wrong handling and sharing rules, increasing the chance of inadvertent disclosure.
settings
Operational notes
Embed classification labels in documents/emails via templates and auto-tagging; ensure labels and handling instructions are updated immediately after reclassification.
02 - Implement
build
Implementation tips
- The IT manager should develop procedures for labelling information based on its sensitivity. They can do this by aligning with the organisation's classification scheme, making sure each piece of information has a label that corresponds to its confidentiality level.
- The HR department should train employees on how to use and apply these labels. They can conduct workshops to explain the different types of labels and what they mean so that staff members are aware of how to handle information safely.
- The office manager should ensure that both physical and digital documents are labelled appropriately. They can set up a system to use physical labels like rubber stamps for hard copies and metadata tags for electronic files.
- The compliance officer must ensure that exceptions to labelling (like non-confidential information) are documented in the procedures. They should also address special cases where labelling may not be possible and outline alternative safeguards.
- The IT team should ensure that information systems automatically append the right metadata for digital files, making it easier to handle information according to its sensitivity. This includes setting up system rules that apply the correct labels as information is created or modified.
03 - Audit
fact_check
Audit / evidence tips
- AskAsk for the documented procedure on information labelling.Look atCheck if the procedure aligns with the organisation's classification scheme and covers all formats of information.GoodThe procedure is comprehensive, easy to understand, and covers physical and digital labelling with details on exceptions.
- AskRequest training records for staff on information labelling.Look atVerify that all relevant personnel have received training on how to properly label sensitive information.GoodTraining records show that all staff have participated, and the content covers the procedures thoroughly.
- AskAsk to see examples of labelled documents, both physical and electronic.Look atExamine whether the labels are clear, consistent, and in line with the organisation's classification scheme.GoodDocuments carry labels that are easy to identify and accurately reflect their sensitivity level.
- AskRequest information system settings or policies on metadata tagging.Look atEnsure that metadata settings enforce the application of classification labels in digital formats.GoodSystems are configured to automatically add appropriate metadata, facilitating correct information management.
- AskAsk for the records of any incidents related to mislabelled information.Look atIdentify causes of mishandling and how they were addressed, if occurred.GoodIncidents are rare, and when they occur, they have been promptly addressed with adjustments in procedures or training.
04 - Mappings
link
Cross-framework mappings
How Annex A 5.13 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ASD ISM
| Control | Notes | Details |
|---|---|---|
open_in_fullBroader than(11)expand_less | ||
| ISM-0201 | ISM-0201 requires very specific physical labelling of TOP SECRET conduits (minimum label size, five-metre intervals, and the marking 'TS ... | |
| ISM-0218 | ISM-0218 requires TOP SECRET fibre-optic fly leads over five metres to be run in a protective, easily inspected pathway and to be clearly... | |
| ISM-0270 | Annex A 5.13 involves implementing procedures for information labelling aligned to the organisation's classification scheme | |
| ISM-0272 | ISM-0272 requires protective marking tools to prevent users selecting protective markings that the system is not authorised to process, s... | |
| ISM-0294 | Annex A 5.13 requires the development and implementation of procedures for labelling information in accordance with the organisation's cl... | |
| ISM-0332 | Annex A 5.13 requires procedures for labelling information as per the classification scheme | |
| ISM-0926 | ISM-0926 mandates a specific labelling/identification convention by prohibiting salmon pink and red for certain sensitivity/classificatio... | |
| ISM-1089 | ISM-1089 requires email protective marking tools to prevent users from selecting a lower protective marking when replying to or forwardin... | |
| ISM-1107 | ISM-1107 requires that Non-classified, OFFICIAL: Sensitive and PROTECTED wall outlet boxes are not coloured salmon pink or red to avoid m... | |
| ISM-1216 | ISM-1216 requires SECRET and TOP SECRET cables that do not use conformant colouring to be banded with the correct colour and labelled at ... | |
| ISM-1720 | ISM-1720 requires wall outlet boxes for SECRET systems to be coloured salmon pink, giving a visible classification marking on network inf... | |
sync_altPartially overlaps(4)expand_less | ||
| ISM-0271 | ISM-0271 requires that protective marking tools do not automatically insert protective markings into emails, controlling how labels are a... | |
| ISM-0293 | ISM-0293 requires IT equipment to be classified (and practically labelled) according to the highest data sensitivity it can process, stor... | |
| ISM-0296 | ISM-0296 requires an organisation to seek ASD approval before applying any labels to the external surfaces of high assurance IT equipment... | |
| ISM-0378 | Annex A 5.13 requires organisations to develop and implement procedures for information labelling aligned to an information classificatio... | |
handshakeSupports(4)expand_less | ||
| ISM-0337 | ISM-0337 mandates that media be used only with systems authorised for its classification | |
| ISM-0831 | ISM-0831 requires media to be handled in accordance with its sensitivity or classification to protect information | |
| ISM-1535 | ISM-1535 requires processes and supporting procedures to prevent AUSTEO, AGAO, and REL data from being exported to unsuitable foreign sys... | |
| ISM-2094 | ISM-2094 requires AI applications to detect and block sensitive data exposure and improper output via content filtering | |
extensionDepends on(1)expand_less | ||
| ISM-0393 | ISM-0393 requires databases and their contents to be classified based on the sensitivity/classification of the data they contain | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related ISO 27001 controls in Organisational controls
Annex A 5.10
Acceptable Use Policies for Information and Assets
Annex A 5.11
Return of Organisation's Assets upon Departure
Annex A 5.12
Information Classification Policy and Practices
Annex A 5.14
Information Transfer Policies and Procedures
Annex A 5.15
Access Control Policies and Procedures
Annex A 5.16
Identity life cycle management
See all Organisational controls controls, or browse the full ISO 27001 library. You can also track all 93 controls with the free ISO 27001 Annex A checklist.
school
Want to implement this control?
Mindset Cyber runs PECB-accredited ISO/IEC 27001 training that maps directly to the controls in this library.